DOCSP-5331: Access Control for creating Views

Author: ravindk89

source/includes/extracts-create-cmd.yaml

@@ -2,9 +2,8 @@ ref: access-control-create-cmd
 content: |
 
   If the deployment enforces 
-  :ref:`authentication/authorization <authentication>`,
-  {{operation}} requires that the authenticated user have the 
-  following privileges:
+  :ref:`authentication/authorization <authentication>`, 
+  {{operation}} requires the following privileges:
 
   .. list-table::
      :header-rows: 1
@@ -45,26 +44,37 @@ content: |
          :authaction:`find` on the view to create does not have
          sufficient privileges.
 
+  The :authrole:`readWrite` built in role includes the required 
+  privileges. Alternatively, you can
+  :ref:`create a custom role <create-user-defined-role>` to support
+  {{operation}}.
+
 post : |
 
-  The :authrole:`readWrite` built in role provides the appropriate
-  privileges for executing {{operation}}. Create a user and assign it
-  the :authrole:`readWrite` role for the database in which you want to
-  run {{operation}}:
+  The following example uses the :method:`db.createUser()` method to 
+  create a user in the ``admin`` database with the ``readWrite``
+  role on the ``inventory`` and ``employees`` database:
 
   .. code-block:: javascript
 
-     db.getSiblingDB("replaceThisDatabaseName").createUser(
+     db.getSiblingDB("admin").createUser(
        {
-         "user" : "replaceThisUserName",
+         "user" : "createViewUser",
          "pwd" : "replaceThisWithASecurePassword",
-         "roles" : [ "readWrite" ]
+         "roles" : [ 
+           { "db" : "inventory", "role" : "readWrite" },
+           { "db" : "employees", "role" : "readWrite" }
+         ]
        }
      )
 
-  For more examples of user creation, see 
-  :doc:`/tutorial/create-users`. For a tutorial on adding privileges to 
-  an existing database user, see :ref:`modify-existing-user-access`.
+  The created user can execute {{operation}} on the specified databases.
+  For more examples of user creation, see :doc:`/tutorial/create-users`.
+
+  Alternatively, you can add the required roles to an existing user 
+  using :method:`db.grantRolesToUser()`. For a tutorial on adding 
+  privileges to an existing database user, see 
+  :ref:`modify-existing-user-access`.
 replacement:
   operation : ":dbcommand:`create`"
 ---
@@ -80,8 +90,7 @@ content : |
 
   If the deployment enforces 
   :ref:`authentication/authorization <authentication>`,
-  the :method:`db.createView()` method requires the authenticated user 
-  have the following privileges:
+  {{operation}} requires the following privileges:
 
   - :authaction:`createCollection` on the database
 
@@ -100,6 +109,11 @@ content : |
   and :authaction:`find` on the view to create does not have sufficient
   privileges.
 
+  The :authrole:`readWrite` built in role includes the required 
+  privileges. Alternatively, you can
+  :ref:`create a custom role <create-user-defined-role>` to support
+  {{operation}}.
+
 source:
   file: extracts-create-cmd.yaml
   ref: access-control-create-cmd